diff options
| author | Luca Deri <deri@ntop.org> | 2019-09-26 21:52:42 +0200 |
|---|---|---|
| committer | Luca Deri <deri@ntop.org> | 2019-09-26 21:52:42 +0200 |
| commit | 0e9918464bb4e734cec0ef370ffc927926e2f810 (patch) | |
| tree | c302fb790bf013c12fb49b2cdea9f70fa37ad080 /src/lib/protocols/stun.c | |
| parent | ce40155377fe7211da546c76de42d3c8024032b9 (diff) | |
Added Zoom protocol support removing invalid STUN/Skype detections
Diffstat (limited to 'src/lib/protocols/stun.c')
| -rw-r--r-- | src/lib/protocols/stun.c | 23 |
1 files changed, 13 insertions, 10 deletions
diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c index 9475192da..cef2a1b31 100644 --- a/src/lib/protocols/stun.c +++ b/src/lib/protocols/stun.c @@ -144,7 +144,8 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct * const u_int16_t payload_length) { u_int16_t msg_type, msg_len; struct stun_packet_header *h = (struct stun_packet_header*)payload; - + int rc; + /* STUN over TCP does not look good */ if (flow->packet.tcp) return(NDPI_IS_NOT_STUN); @@ -319,6 +320,11 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct * #endif switch(attribute) { + case 0x0103: + flow->guessed_host_protocol_id = NDPI_PROTOCOL_ZOOM; + return NDPI_IS_STUN; + break; + case 0x4000: case 0x4001: case 0x4002: @@ -457,15 +463,12 @@ udp_stun_found: printf("==>> NDPI_PROTOCOL_WHATSAPP_CALL\n"); #endif - if ((ntohs(packet->udp->source) == 3478) || (ntohs(packet->udp->dest) == 3478)) { - flow->guessed_host_protocol_id = (is_messenger_ip_address(ntohl(packet->iph->saddr)) || - is_messenger_ip_address(ntohl(packet->iph->daddr))) ? NDPI_PROTOCOL_MESSENGER : - NDPI_PROTOCOL_WHATSAPP_CALL; - } else - flow->guessed_host_protocol_id = (is_google_ip_address(ntohl(packet->iph->saddr)) || - is_google_ip_address(ntohl(packet->iph->daddr))) ? NDPI_PROTOCOL_HANGOUT_DUO : NDPI_PROTOCOL_WHATSAPP_CALL; - - int rc = (flow->protos.stun_ssl.stun.num_udp_pkts < MAX_NUM_STUN_PKTS) ? NDPI_IS_NOT_STUN : NDPI_IS_STUN; + if(is_messenger_ip_address(ntohl(packet->iph->saddr)) || is_messenger_ip_address(ntohl(packet->iph->daddr))) + flow->guessed_host_protocol_id = NDPI_PROTOCOL_MESSENGER; + else if(is_google_ip_address(ntohl(packet->iph->saddr)) || is_google_ip_address(ntohl(packet->iph->daddr))) + flow->guessed_host_protocol_id = NDPI_PROTOCOL_HANGOUT_DUO; + + rc = (flow->protos.stun_ssl.stun.num_udp_pkts < MAX_NUM_STUN_PKTS) ? NDPI_IS_NOT_STUN : NDPI_IS_STUN; return rc; } |